3 ms·
About the "validity" period: in practice it seems to be more like a rotation period, the code themselves seem to be valid longer than this, that is you can ofte
by leni536 2y ago
About the "validity" period: in practice it seems to be more like a rotation period, the code themselves seem to be valid longer than this, that is you can often enter them for quite some time after they get rotated.
And I also often wonder about the OTP aspect, whether there is any protection in TOTP backends for the same TOTP being used twice.
- edent 2y agoThe validity is up to the service, as described in https://datatracker.ietf.org/doc/html/rfc6238#section-5.2 https://datatracker.ietf.org/doc/html/rfc6238#section-5.2 Because of clock skew and latency, a service might choose to allow the previous and/or next code as being acceptable.
- metters 2y agoI am not sure whether TOTP can be used two times, but that longer validity aspect already lead to a vulnerability called "Microsoft MFA AuthQuake"
- fanf2 2y agoThey repeat roughly every year. 1,000,000 periods of 30 seconds is just less than 350 days.
- Rygian 2y agoThey do not repeat. The totp is calculated with the whole Unix timestamp, not a cyclical counter.
- edent 2y agoYes, but there are only 6 digits available. So a million different codes can be generated. A new code is generated every 30 seconds Rather pleasingly, 30,000,000 seconds is roughly 1 year. So, assuming a uniform distribution of codes, you would expect to see a repeat after a year.
- matthewdgreen 2y agoA code may be repeated, but they should not enter a cycle (which would be a real disaster.) You also need to keep in mind the birthday paradox. Repeated codes will happen with high probability after around sqrt(1,000,000) = 1000 code emissions. https://en.wikipedia.org/wiki/Birthday_problem https://en.wikipedia.org/wiki/Birthday_problem